Internet-connected devices are ripe for hacking—and it seems that wearable gadgets like Google’s forthcoming head-mounted computer, Glass, are no exception.
Marc Rogers, principal security researcher at mobile security startup Lookout, said this week that the company’s researchers examined Google Glass in May, looking for weaknesses that hackers could exploit. They soon focused on the fact that Google uses QR codes to let users configure Glass, and that whenever a Glass user takes a photo, the device searches for readable information (including QR codes).
The researchers learned that it was possible to use custom QR codes to get Glass to do things without the wearer’s knowledge, like quietly connect to a hacker-controlled wireless network. This could occur when the wearer takes a picture of a QR code on a poster or T-shirt, for example, believing the code to be benign.
The Lookout researchers found that by creating a QR code that caused Glass to connect to their own wireless access point, they could control traffic coming on and off the device, Rogers said. In theory, this would allow a hacker to spy on a user’s uploaded photos, or direct him to malware on the Web.
Similarly, the researchers found that a QR code could force Glass to connect via Bluetooth to a device of the researcher’s choosing, without the Glass wearer’s knowledge.
Though Lookout quickly reported the weakness to Google, and the search company fixed the problem within two weeks, it points to a larger problem: as everything from glasses to watches to thermostats become Internet-connected, those gadgets become vulnerable to malware and other security and privacy issues.
“I think bad guys will target wherever they feel the opportunity is,” said Rogers, noting that every popular computing platform has become a target for malware.
Rogers sees Google as a good test case for how such connected devices can be rolled out: before selling Glass next year to the general public, the company offered it to a limited group of testers, who are developing apps and finding bugs—a move the company says is intended to resolve problems in advance of general sales.
Because of this, Rogers expects that when Glass is released, Google will have not only fixed most of the “low-hanging” vulnerabilities, but will also be able to quickly fix any other issues that emerge.
How AI is reinventing what computers are
Three key ways artificial intelligence is changing what it means to compute.
These weird virtual creatures evolve their bodies to solve problems
They show how intelligence and body plans are closely linked—and could unlock AI for robots.
We reviewed three at-home covid tests. The results were mixed.
Over-the-counter coronavirus tests are finally available in the US. Some are more accurate and easier to use than others.
A horrifying new AI app swaps women into porn videos with a click
Deepfake researchers have long feared the day this would arrive.
Get the latest updates from
MIT Technology Review
Discover special offers, top stories, upcoming events, and more.